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ABSTRACT 

This  document  covers  the  Preliminary  Hazard  Analysis 
(PHA)  for  the  "Externally  Mounted,  Automatically 
Expelled/Inflated  Multiplace  Life  Raft  for  Helicopters 
(Automatic  Life  Raft  System  - ALRS ) and  the  "Sink 
Rate  Delay/Improved  Water  Stability  System  for 
Helicopters"  (Helicopter  Flotation  System  - HFS ) . 

The  analysis  was  prepared  in  accordance  with  the 
requirements  of  NADC  Contract  N62269-76-C-0 341  , Data 
Item  A009. 
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1.0  INTRODUCTION 

A Preliminary  Hazard  Analysis  (PIIA)  was  performed  for  the 
Automatic  Life  Raft  System  ( ALRS ) and  the  Helicopter  Flotation 
System  (I1FS)  . A Preliminary  Hazard  Analysis  (PHA)  is  a 
qualitative  study  and  is  the  initial  formal  system  safety 
analysis  task.  It  is  used  to  assess  risk  areas  of  the  system 
and  identify  safety  critical  subsystem  or  components.  It 
identifies  gross-hazardous  conditions  and  provides  guidance  for 
the  performance  of  subsequent  indepth  safety  analyses  such  as 
Subsystem  Hazard  Analyses  (SSHA)  and  Operating  Hazard  Analyses 
(OHA) . 

2.0  BACKGROUND 

2.1  When  a helicopter  enters  water  due  to  an  emergency  or 
impacts  water  inadvertently,  two  major  causes  of  casualties  to 
the  occupants  arise.  First,  helicopters  enter  the  water  and 
sink-often  in  less  than  one  minute.  Second,  because  helicopters 
are  not  built  as  boats,  they  are  unstable  in  water.  This 
instability  frequently  causes  instant  rollover,  making  egress 
difficult  or  impossible. 

Numerous  problems  confront  would-be  survivors  in  their  efforts 
to  egress  successfully  from  sinking,  capsizing  helicopters. 

They  must  contend  with  shifting  displaced  cargo  and  equipment 
inside  the  cabin.  They  must  cope  with  disorientation,  confusion, 
and  panic  as  the  helicopter  impacts,  fills  with  water,  capsizes 
and  sinks.  They  must  release  restraining  straps  and  locate, 
release  and  display  internally  stowed  life  rafts.  Through  it  all 
they  must  contend  with  inrushing  water.  After  getting  out  of  the 
helicopter  and  reaching  the  surface,  both  major  undertakings, 
helicopter  borne  personnel  must  contend  with  the  ultimate 
challenge,  survival  on  the  water  surface. 

2.2  Two  concepts  for  increasing  survivability  under  the  above 
conditions  have  been  proposed: 

o Automatic  Life  Raft  System  (ALRS) 

o Helicopter  Flotation  System  ( HFS ) 

The  proposed  systems  have  been  configured  for  the  11-46  helicopter,  j 

2.3  For  further  background  on  helicopter  water  entry  problems, 
the  reader  is  referred  to  Document  D210-11003-1  "Sink  Rate 
Delay/ Improved  In-Water  Stability  System  for  Helicopters".  For 
a comparison  of  the  effectiveness  of  the  two  systems,  Document 
D210-IL101-1  "Comparative  System  Analysis  of  Helicopter  Flotation 
System  vs.  Life  Raft  Study"  should  be  referred  to. 
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3.0  SYSTEM  DESCRIPTIONS 

The  physical  and  operating  characteristics  are  described  below 
for  each  system.  It  should  be  noted  that  the  activation  systems 
for  deploying  either  the  life  rafts  or  the  flotation  bags  are 
basically  the  same.  Deployment  may  be  initiated  by  the  aircrew 
or  automatically,  and  similar  system  safeguards  are  provided 
in  order  to  preclude  inadvertent  system  operation. 

3.1  AUTOMATED  LIFE  RAFT  SYSTEM  (ALRS) 

3.1.1  Physical  Characteristics 
Basic  elements  of  the  system  are: 
o Two  15  man  GFE  life  rafts 

o Two  reinforced  fiberglass  life  raft  containers  and  attachment 
points 

o Two  inflators 
o Electrical  activation  system 

The  conceptual  design  conf iguration  for  the  Automated  Life  Raft 
System  is  shown  in  riguro  1.  It  consists  of  two  15  man  life 
rafts  located  in  externally  mounted  fiberglass  containers 
attached  to  either  side  of  the  H-46  helicopter.  The  rafts  can 
be  deployed  and  inflated  m approximately  10-1^  seconds.  Pilot 
or  automatically  fired  squibs  cause  gas  to  be  released  from  the 
inflators  and  into  the  rafts.  Types  of  inflators  under 
consideration  include  compressed  aas  bottles,  cool  oas  generators  i 
coupled  with  air  aspirators,  and  solid  propellant  generators 
coupled  with  air  aspirators. 

I The  life  raft  containers  are  attached,  via  mounting  brackets  and 
bolts,  to  established  hard  points  on  either  side  of  the  fuselage 
between  stations  220  and  25-1.  The  container  door  is  secured  in 
place  by  a hinge  and  over-center  type  latches.  For  deployment 
of  the  raft,  the  door  is  opened  by  the  pressure  from  the 
inflating  raft.  (Note:  Velcro  is  being  considered  as  an 
alternate  means  of  providing  the  fastening  and  opening  functions 
for  the  door).  Once  deployed,  the  rafts  remain  connected  to  the 
he  1 icopte : by  umbilical  lines.  Should  the  helicopter  sink,  the 
I lines  pull  free  from  the  helicopter  due  to  raft  buoyancy  and 
j the  rafts  remain  on  the  surface. 

! 3.1.2  System  Operation 

Two  methods  of  deployment  are  provided.  The  primary  methods  of 
deployment  require  actuation  of  the  system  by  the  pilot  or  a 
cabin  crewmember  after  the  aircraft  is  in  the  water.  The  other 
method  is  automatic  deployment  of  the  life  rafts  after  water 
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impact  and  rotor  stoppage.  Figure  2 shows  a general  schematic 
of  the  system. 

3. 1.2.1  Sequence  for  Pilot  or  Crewmember  Operation 

a.  The  pilot  (or  the  crewmember)  arms  the  system  via  the 
guarded  arming  switch.  The  helicopter  enters  the  water 
with  power,  and  stabilizes  with  rotors  turning.  The 
aircraft  is  under  pilot  control. 

b.  Engine  condition  levers  are  retarded;  rotor  brake  arming 
lever  is  armed;  rotor  brake  is  applied.  Aircraft  is  secured. 

c.  The  deployment  switch  is  put  to  the  "on"  position  by  the 
pilot  (or  crewmember)  activating  the  inflation  sequence  for 
the  two  rafts. 

d.  The  container  doors  open  as  the  rafts  inflate  out  of  their 
containers . 

e.  Aircrew  egress  to  life  rafts. 

3. 1.2.2  Sequence  for  Automatic  Operation 

a.  Rotor  brake  arming  handle  switch  is  closed  if  rotor  brake  is 
not  armed.  (Nrote:  Rotor  brake  can  not  be  armed  if  throttles 
are  in  fly  position) . 

b.  Main  landing  gear  also  is  fully  extended.  Oleo  switch  is 
closed.  (In  flight,  the  landing  gear  is  always  extended). 

c.  Both  generators  drop  off  the  line  as  rotor  RPM  is  lost.  The 
two  generator  switches  are  closed. 

d.  Zero  speed  sensor  switch  closes  when  rotor  speed  is  less 
then  1 RPM. 

e.  When  contacts  are  all  closed,  squibs  fire,  rafts  inflate 
out  of  containers,  popping  doors  open. 

f.  Aircrew  egress  to  life  rafts. 

3.2  HELICOPTER  FLOTATION  SYSTEM  (HFS) 

3.2.1  Physical  Characteristics 
Basic  elements  of  the  system  are: 

o Four  flotation  bags 
o Four  inflntors 

o Four  flotation  bag  encapsulations 
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o Harness  and  retention  cable 
o Electrical  activation  system 

The  conceptual  design  configuration  for  the  Helicopter  Flotation 
System  is  shown  in  Figure  3.  It  consists  of  four  spherical 
flotation  bags,  externally  encapsulated  to  the  fuselage,  to 
provide  additional  buoyancy  and  stability  to  the  helicopter  upon 
making  a water  entry.  The  bags  are  contained  in  two  nose  blisters 
and  two  stub  wing  pods.  Established  hardpoints  at  the  base  cf 
the  nose  landing  gear  and  on  each  stub  wing  serve  as  anchor 
points  for  the  bags.  The  bags  can  be  deployed  and  inflated  in 
approximately  10-15  seconds.  Pilot  or  automatically  fired  squibs 
cause  gas  to  be  released  from  the  inflators  and  into  the  bags. 
Types  of  inflators  under  consideration  include  compressed  gas 
bottles,  cool  gas  generators  coupled  with  air  aspirators,  and 
solid  propellant  generators  coupled  with  air  aspirators. 

The  bag  material  is  a protective  coated  nylon  construction  with 
dual  compartments  in  each  sphere  to  prevent  total  loss  of 
buoyancy  in  the  event  of  a puncture,  rupture,  or  leak.  Each 
deflated  bag  is  approximately  1.5  cubic  feet  in  volume.  The 
inflated  bag  is  6 feet  in  diameter.  The  encapsulations  are  of 
fiberglass/metal  construction. 

Figure  4 shows  the  method  for  retaining  the  inflated  bags.  A 
retention  cable  connects  each  bag  harness  to  a hardpoint  on  the 
airframe.  The  bag  harness  consists  of  five  harness  ropes  bonded 
to  the  bag  at  ten  points  around  the  equator  of  the  bag.  The  ropes 
pass  through  a retention  ring  which  is  attached  to  the  retention 
cable . 

The  encapsulation  or  container  door  is  secured  in  place  by  a 
hinge  and  over-center  type  latches.  For  deployment  of  the  bag, 
the  door  is  opened  by  the  pressure  from  the  inflating  bag. 

(Note:  Velcro  is  being  considered  as  an  alternate  means  of 

providing  the  fastening  and  opening  functions  for  the  door). 

3.2.2  System  Operation 

The  flotation  bags  may  be  inflated  by  pilot  command  or  auto- 
matically. Automatic  deployment  is  provided  in  the  event  the 
helciopter  is  inadvertently  flown  into  the  water  and  the  pilot  is 
incapacitated.  A general  schematic  of  the  system  is  shown  in 
Figure  5. 

3. 2. 2.1  Sequence  for  Pilot  Operation 


The  flotation  deployment  switch  is  put  to  the  "on"  position 
activating  the  inflation  sequence  for  all  four  bags. 
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c.  The  encapsulation  doors  open  as  the  bags  inflate  out  of  their 
containers . 

d.  Engine  condition  levers  are  retarded;  rotor  brake  arming 
lever  is  armed;  rotor  brake  is  applied.  Aircraft  is  secured. 

e.  Aircraft  floats  upright. 

3. 2.2.2  Sequence  for  Automatic  Operation 

a.  Rotor  brake  arming  handle  switch  is  closed  if  rotor  brake 
is  not  armed.  (Note:  Rotor  brake  can  not  be  armed  if 
throttles  are  in  "FLY"  position) . 

b.  Main  landing  gear  also  is  fully  extended.  Oleo  switch  is 
closed.  (In  flight,  the  landing  gear  is  always  extended) . 

c.  Doth  generators  drop  off  the  line  as  rotor  RPM  is  lost. 

(The  two  generator  switches  are  closed) . 

d.  Zero  speed  sensor  switch  closes  when  rotor  speed  is  less  than 
1 RPM. 

e.  When  all  of  the  above  switches  are  closed,  squibs  fire, 
bags  inflate  out  of  containers,  popping  doors  off,  bags 
inflate  into  position. 

f.  Helicopter  floats  upright. 
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Figure  4 Spherical  Buoyancy  Float 
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4.0  CONCLUSIONS  AND  RECOMMENDATIONS 

4.1  The  hazardous  conditions  of  primary  concern  relative  to  the 
1IFS  and  ALRS  ^ may  be  stated  as  follows: 

o Inadvertent  system  actuation  or  malfunction  of  system 
components  causes  a ground  accident, flight  accident,  or 
injury/death  to  personnel. 

o Failure  of  the  system  to  function  as  intended  results  in 
the  system  not  being  available  for  personnel  survival. 

4.2  The  Preliminary  Hazard  Analysis  (PHA)  for  the  HFS  and  ALRS 
has  not  identified  any  items  associated  with  the  above  hazardous 
conditions  which  can  be  classified  as  a high  (111)  risk,  as  defined 
in  Table  1.  The  PHA  has  identified  a number  of  low  (LO)  risk  items 
which  will  require  detail  attention  prior  to  and  during  the  design 
and  test  phases  in  order  to  assure  that  adequate  hazard  controls 
are  incorporated. 

4.3  Recommendations  which  resulted  from  the  review  of  the  concept 
conf igurations  and  which  should  be  considered  during  follow-on 
design  and  test  phases  are: 

a.  Incorporate  a "Flotation  System  (or  Raft  System)  Armed" 
light  in  the  cockpit. 

b.  Design  for  water  impact  conditions  to  preclude  system 
material  failures,  jamming,  and  activation  circuit  failures. 
Select  component  locations  which  protect  or  shield  against 
water  impact: 

Container  and  container  mounts 
Container  door  and  door  latches 

Activation  circuit  (wires  and  inhibitors  such  as 
oleo  switch) 

c.  Eliminate  activation  circuit  deficiencies  noted  in  Appendix  A. 

d.  Provide  means  for  quick  release  of  bags/rafts. 

e.  Assure  that  the  selected  inflator  configuration 

will  not  permit  water  entry  into  the  bags  or  rafts  (gas 
genera tor/ar.pira tor  type) 

(1)  Because  of  the  similarity  of  the  (IFF  and  ALRS,  the  conclusion 
and  recommendations  presented  here  apply,  unless  otherwise 
noted,  to  either  system. 
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will  have  gas  temperatures  compatible  with  bag  or  raft 
material  (solid  propellant  type  generators) 

uses  a gas  that  has  acceptable  toxicity/flammability 
properties . 

f.  Review  and  assure  that  the  Nr  inhibitor  constraints  do  not 
preclude  timely  system  actuation.  (The  Nr  inhibitor  precludes 
automatic  system  deployment  until  the  rotors  are  essentially 
stopped -Nr<  1 RPM.  Under  certain  impact  conditions  such  a 
time  delay  could  be  critical  to  personnel  survival.) 

g.  Review*  and  assure  the  reliability  of  the  "oleo"  or  "squat 
switch"  inhibitor.  (Failure  of  "squat  switch"  precludes 
automatic  system  deployment.  Continuous  exposure  of  the 
switch/switch  sensor  mechanization  to  the  environment  during 
normal  aircraft  operation  and  the  requirement  that  the  switch 
not  malfunction  when  submerged  in  water  requires  special 
attention  during  the  design  phase. 

h.  Perform  EMI  tests  to  assure  that  the  system  is  not  subject  to 
deployment  by  EMI  sources. 

i.  Perform  wind  tunnel  tests  to  determine  controllability  of 
aircraft  if  system  is  inadver tently  deployed  in  flight. 

j.  Perform  environmental  testing  of  selected  components:  water 
immersion,  humidity,  salt  spray,  sand  and  dust,  temperature, 
vibration . 

4.4  Based  upon  the  above  findings  from  the  PHA,  the  following 

safety  design  criteria  are  proposed  for  the  HFS  and  ALRS : 

a.  No  single  failure  or  human  error  in  the  HFS  or  ALRS  shall 
cause  a flight  safety  loss. 

b.  No  single  failure  or  human  error  shall  result  in  loss  of 
function  of  the  HFS  or  ALRS  so  as  to  preclude  personnel 
survival . 

c.  No  single  failure  or  human  error  shall  cause  the  HFS  or 
ALRS  t:o  deploy  when  makinq  normal  ground  or  water  landings 
(deployment  is  not  wanted) . 

d.  The  above  "single"  failure  constraints  are  subject  to  the 
following  conditions: 

o A failure  following  an  undetected  failure  and  Cu  ses  the 
above  events  shall  be  counted  as  a sinole  failure. 
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o The  pilot  activated  system  and  automatically  activated 
system  shall  be  considered  as  mutual  back-up  systems 
(e.g.,  a single  failure  in  the  pilot  activated  system 
which  does  not  permit  commanded  deployment  shall  be 
considered  to  satisfy  the  above  conditions  if  the 
automatic  system  causes  deployment) . 

e.  The  IIFS  and  ALRS  components  shall  be  designed  for  water 
impact  conditions. 

f.  Provisions  shall  be  made  for  pre-flight  checks  for  activation 
circuit  continuity  and  inhibitor  status. 

g.  Provisions  shall  be  made  for  rapid  release  of  bags  or  rafts. 

If  deviations  from  the  above  criteria  are  required  because  of 
cost,  weight,  reliability,  etc.  issues,  the  supporting  rationale 
shall  be  documented. 


SHEET  19 


5.0  PRELIMINARY  HAZARD  ANALYSIS  (PHA) 


5. I  METHODOLOGY 


5.1.1  The  technique  for  conducting  the  PHA  consists  of  two 
basic  steps: 

a.  A top  level  fault  tree  to  provide  the  visibility  of  the 
hazardous  conditions  to  be  considered. 

b.  A columnar  format  to  translate  the  hazardous  conditions 
identified  on  the  fault  tree  to  a cause  and  evaluation 
presentation  on  the  columnar  format.  The  columnar  format 
describes  the  hazard,  how  the  hazard  can  occur,  safety 
considerations,  safety  assessment,  relative  risk,  and 
requirements  for  additonal  analysis. 

Relative  risk,  as  used  in  the  PHA,  is  a measure  of  confidence  of 
eliminating  and  controlling  potentially  hazardous  conditions. 

Risk  is  defined  as  HIGH  (HI)  or  LOW  (LO)  by  assessing  the  likeli- 
hood of  hazard  occurrence.  The  defintions  are  listed  in 
Table  1.  The  Detail  Analysis  Level  column  pinpoints  additional 
types  of  hazard  analyses  which  should  be  performed  during  the 
detail  design  phase. 

TABLE  1 - RELATIVE  RISK  DEFINITIONS 


Relative  Risk 


Symbol 


Definition 


Hazard  controls  are  adequate,  have 
been  used  in  the  past,  and  require 
little  or  no  development 

Hazard  controls  are  identified  and 
considered  adequate , but  may  need 
development.  Will  require  monitoring 
during  design  and  test. 

Hazard  controls  arc  inadequate. 

Method (s)  have  not  been  established. 

Hazard  Cent  rols  are  inadequate  or  are 
beyond  the  Contractor's  control. 


5.1.2  A brief  introduction  to  the  analysis  sheets  that  follow 
is  provided.  The  analysis  ter  the  Helicopter  Flotation  System 
(HFS)  was  portormod  first.  The  fault  tree  for  the  HFS  is 
presented  followed  by  the  columnar  sheets.  Next,  the  fault  tree 
for  the  Automat  to  Life  Raft  System  (ALUS)  is  presented.  Because 
the  HFS  and  ALRS  fault  trees  are,  in  fact  , almost  identical  and 
because  the  tiFS  and  ALRS  arc  very  similar  ir.  mechanization 
concept , the  HFS  analysis  sheets  are  applicable  to  the  ALRS. 
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It  was  found  necessary  to  review  only  one  additional  hazardous 
condition  (which  applied  only  to  the  ALRS),  "Life  rafts  are  not 
accessible  for  survival."  Finally,  a cursory  review  was 
conducted  of  the  basic  HFS  activation  schematic  for  possible 
undesirable  or  hazardous  conditions  that  could  result  from 
sinyle  point  failures  or  human  errors.  This  review  is  presented 
in  Appendix  A. 
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APPENDIX  A 


Safety  Comments  on  1IFS  Activation  Schematic 


A cursory  review  was  conducted  of  the  HFS  activation  schematic 
for  possible  undesirable  or  hazardous  conditions  that  could  result 
from  single  point  failures  or  human  errors.  The  schematic  per 
Figure  5 was  reviewed  for  various  operating  modes  as  shown  in 
Table  2.  The  review  has  indicated  the  need  for  further  considera- 
tions and/or  revisions  of  the  schematic  before  proceeding  with 
hardware  design.  Conditions  noted  are: 

1.  Operation  Mode:  A/C  Parked,  Electrical  Power  on  A/C 
(e.g.  for  maintenance  check,  etc.) 

o Bags  deploy  if  "arm  switch"  is  intentionally  closed  to 
make  the  test  circuit  check. 

o Test  circuit  verifies  continuity  of  only  one  of  the  two 
squibs  connected  in  parallel. 

o Test  circuit  does  not  verify  status  of  all  circuit 
inhibitors . 

o Sneak  circuit  precludes  test  function  of  two  liahts. 
o Failure  of  Oleo  inhibitor  will  cause  bags  to  deploy. 

2.  Operation  Mode:  Pilot  Deploys  Bags  after  Water  Landing 

( Rotcr  N_  = 0) 

K 

o Single  failure  (wire  break  or  short  to  ground)  precludes 
deployment  by  pilot. 

o Single  failure  (wire  break  or  short  to  ground)  precludes 
deployment  by  automatic  circuit. 

3.  Operation  Mode:  Water  Impact  - Pilot  is  Incapacitated 

o Single  failure  (wire  break  or  short  to  ground)  precludes 
deployment  by  automatic  system. 

4.  Operation  Mode:  Normal  Water  Landing  and  Shutdown  - Bag 
Deployment  Not  Wanted 

o If  HFS  "arm  switch"  is  in  the  "armed"  position,  bags  will 
deploy . 

o If  Dilot  forgets  to  arm  rotor  brake,  bags  will  deploy. 
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APPENDIX  "A"  (Continued) 


5.  Operation  Mode:  Normal  Water  Landing,  Rotor  RPM  @ Ground 
Idle  - Bag  Deployment  Not  Wanted 

o Failure  of  N inhibitor  can  cause  bags  to  deploy. 

K 

o Single  failure  (short  to  ground)  causes  bags  to  deploy. 


■ 
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POSITION  OF  HFS  INHIBITORS  tOPSN  CP  CLOSED)  FOR  VARIOUS  OPERATING  MODES 


